UNDERSTANDING THE FINAL RULE FOR 42 CFR PART 2 AND …

1 UNDERSTANDING THE FINAL RULE FOR 42 CFR PART 2 AND NEXT STEPSW ednesday, August 12, 2020 Hosted by American Academy of Addiction Psychiatry, American Psychiatric Association, and American Society of Addiction MedicineKaren Drexler, MD Medical Director of the American Academy of Addiction Psychiatry Associate Professor in Psychiatry and Behavioral Sciences at Emory University Member of American Academy of Addiction Psychiatry, the American Psychiatric Association, and the American Society of Addiction Medicine Previously worked as the National Mental Health Program Director for Substance Use Disorders at the Department of Veteran Affairs Central Office 2020 American Psychiatric Association. All rights to 42 Part 2 The Substance Abuse and Mental Health Services Administration released a FINAL rule on July 13 to go into effect on Friday, August 14, 2020. The CARES Act of 2020 approved by Congress and signed into law made several changes to 42 Part 2 s enabling legislation.

2 Additional regulations will be needed to implement the changes, which can go into effect no earlier than March 27, 2021 Deepa Avula, MPH Chief of Staff/Director of Office of Financial Resources (OFR), Substance Abuse and Mental Health Services Administration, Department of Health and Human Services Responsible for formulating SAMHSA s more than $3 billion dollar budgetGerald (Jud) DeLoss, JD Chief Executive Officer, Illinois Association for Behavioral Health (IABH) Previously worked as Deputy General Counsel and General Counsel of IABH Testified before the United States House of Representatives, Energy and Commerce Committee as a subject matter expert on 42 Part 2 Brian Hurley, MD, MBA, FASAM Addiction Psychiatrist Director of Addiction Medicine for the Los Angeles County Department of Health Services. Member of American Academy of Addiction Psychiatry, the American Psychiatric Association, and the American Society of Addiction Medicine Serves on the Board of Directors of ASAM 2020 American Psychiatric Association.

3 All rights Part 2 FINAL RuleDeepa AvulaSubstance Abuse and Mental Health Services Administration 2020 American Psychiatric Association. All rights Part 2:CARES Act Modifications to42 290dd-2 Gerald (Jud) E. DeLoss, Association for Behavioral Health 2020 American Psychiatric Association. All rights Act Modifications to 42 290dd-s 42 290dd-2 is statutory basis for 42 Part 2 the Confidentiality of Substance Use Disorder Patient Records regulations Federal Coronavirus Aid, Relief, and Economic Security (CARES) Act signed March 27, 2020 amends 42 290dd-2 to align more closely with Health Insurance Portability and Accountability Act ( hipaa ) Requires general consent for disclosure of substance use disorder (SUD) treatment records Allows disclosure of covered records for treatment, payment and health care operations Recipients include Part 2 programs, hipaa covered entities and business associates May be redisclosed in accordance with hipaa Allows for disclosure of de-identified SUD records to public health authorities Prohibits use of SUD records in civil, criminal, legislative, or administrative proceedings other than by Court order or patient consent Adopts hipaa fines and penalties in place of old Part 2 criminal enforcement mechanism Obligation to comply with hipaa breach notification requirements Protections against discrimination based on intentional or inadvertent disclosure of SUD records 2020 American Psychiatric Association.

4 All rights 2 Regulations CARES Act amended statute on which Part 2 is based Part 2 regulations were not directly amended by CARES Act Questions raised regarding enforceability HHS has stated that the FINAL regulations incorporating the CARES Act revisions will not be effective prior to March 2021 2020 American Psychiatric Association. All rights 2 -Disclosures Part 2 Programs must still obtain consent in order to disclose Uses and disclosures only for treatment, payment, and certain health care operations Only to other Part 2 programs, hipaa covered entities or business associates Ability of recipients to redisclose pursuant to hipaa Accounting of disclosures requirement under HITECH Act now applies Right of individual to request restriction on use or disclosure under HITECH Act 2020 American Psychiatric Association. All rights 2 -Consent Consent Must be obtained prior to disclosure Must be in writing May obtain consent once for all future uses or disclosures until revoked Revocation Once revoked, how will it impact downstream recipients?

5 2020 American Psychiatric Association. All rights 2 Model Notice of Privacy Practices Model notice to be issued by the Secretary not later than 1 year after enactment of the CARES Act Must be easily understandable and in plain language Must include: Statement of the patient s rights with respect to protected health information (including for self-pay patients) Brief description of how the individual may exercise their related rights Description of each purpose for which the covered entity is permitted or required to use or disclose protected health information without the patient s written authorization 2020 American Psychiatric Association. All rights 2 Breach Notification Breach the acquisition, access, use, or disclosure of protected health information in a manner not permitted under applicable regulations which compromises the security or privacy of the protected health information. Disclosure in a manner not permitted by regulations is presumed to be a breach, unless Good faith but unintentional acquisition, access or use by workforce member or person under the authority of a covered entity or business associate if no unpermitteduse or disclosure Inadvertent disclosure by and to person with authorized access at covered entity or business associate if no further unpermitteduse or disclosure Covered entity can demonstrate through risk assessment that there is a low probability that the protected health information has been compromised 2020 American Psychiatric Association.

6 All rights 2 Breach Notification In case of a breach, covered entity must notify each individual whose unsecured protected information has been, or is reasonably believed to have been, accessed, acquired, or disclosed as a result of such breach. Business associates notify covered entities of breach Breach is considered discovered as of the first day on which it is known to the covered entity, or by which the covered entity would have known had it exercised reasonable diligence Must notify patient without unreasonable delay and no more than 60 calendar days after discovery Notice must be written in plain language and must include, to the extent possible: Brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known; Description of the types of unsecured protected health information involved in the breach ( , full name, SSN, DOB, home address, account number, diagnosis, disability code, etc.)

7 ; Steps individuals should take to protect themselves from potential harm resulting from the breach; Brief description of the covered entity s actions to investigate the breach, mitigate harm to individuals, and protect against further breaches; Contact procedures for questions or additional information Must notify HHS within 60 days if 500 or more individuals; within 60 days of end of calendar year for others Must notify media if more than 500 individuals in state or jurisdiction 2020 American Psychiatric Association. All rights 2 Anti-Discrimination Adds explicit protections against discrimination based upon Part 2 records or information about the patient disclosed under Part 2 either inadvertently or intentionally. Specifically, no entity may discriminate against a patient about whom the Part 2 records relate in: Admission, access to, or treatment for health care Hiring, firing, or terms of employment, or receipt of worker s compensation Sale, rental, or continued rental of housing Access to Federal, State, or local courts Access to, approval of, or maintenance of social services and benefits provided or funded by Federal, State, or local governments No recipient of Federal funds may discriminate against the patient based upon the Part 2 records in affording access to the services provided with such funds 2020 American Psychiatric Association.

8 All rights 2 Use in Proceedings Except with a valid court order or patient consent, Part 2 records or testimony about such records may not be disclosed or used in any civil, criminal, administrative , or legislative proceeding conducted by any Federal, State, or local authority, against a patient, including that: The record or testimony shall not be entered into evidence in any criminal prosecution or civil action before a Federal or State court The record or testimony shall not form part of the record for decision or otherwise be taken into account in any proceeding before a Federal, State, or local agency The record or testimony shall not be used by any Federal, State, or local agency for a law enforcement purpose or to conduct any law enforcement investigation 2020 American Psychiatric Association. All rights 2 Penalties and Enforcement Part 2 has historically been enforced criminally by the US Attorney (42 ) and penalties under Title 18 of the Code (42 ) Penalties now set forth under sections 1176 and 1177 of the Social Security Act (42 1320d 5 and 42 1320d 6), whichare the penalties imposed for hipaa violations Penalties for civil violations hipaa violation: Unknowing -Penalty range: $100 -$50,000 per violation, with annual maximum of $25,000 for repeat violations hipaa violation: Reasonable Cause -Penalty range: $1,000 -$50,000 per violation, with annual maximum of $100,000 for repeat violations hipaa violation: Willful neglect but violation is corrected within the required time period -Penalty range: $10,000 -$50,000 per violation, with an annual maximum of $250,000 for repeat violations hipaa violation: Willful neglect and is not corrected within required time period -Penalty range.

9 $50,000 per violation, with an annual maximum of $ million Criminal penalties Knowingly" obtain or disclose individually identifiable health information, in violation of the administrative simplification Regulations, face a fine of up to $50,000, as well as imprisonment up to 1 year Offenses committed under false pretenses allow penalties to be increased to a $100,000 fine, with up to 5 years in prison Offenses committed with the intent to sell, transfer or use individually identifiable health information for commercial advantage, personal gain or malicious harm permit fines of $250,000 and imprisonment up to 10 years 2020 American Psychiatric Association. All rights 2 Sense of CongressIt is the sense of the Congress that 1)Any person treating a patient through a Part 2 program or activity with respect to which the SUD confidentiality requirements apply is encouraged to access the applicable State-based prescription drug monitoring program when clinically appropriate2)Patients have the right to request a restriction on the use or disclosure of a SUD record for treatment, payment, or health care operations3)Covered entities should make every reasonable effort to the extent feasible to comply with a patient's request for a restriction regarding such use or disclosure4)

10 For purposes of SUD confidentiality protections, health care operations shall have the meaning given such term in the hipaa regulations except that this term shall not include the creation of de-identified health information or a limited data set, and fundraising for the benefit of the covered entity 5)Programs creating protected SUD records should receive positive incentives for discussing with their patients the benefits to consenting to share such records 2020 American Psychiatric Association. All rights CFR Part 2 FINAL Rule Published 7/15/20 FINAL Rule amending 42 Part 2 was published July 15, 2020 Effective August 14, 2020 Based on Notice of Proposed Rulemaking of August 2019 Does NOT include CARES Act provisions 2020 American Psychiatric Association. All rights of July 2020 FINAL Rule Definitions ( ) Revises the definition of Records to create an exception so that information communicated orally by a Part 2 program to a non-Part 2 provider for treatment purposes with consent does not become a record subject to Part 2 merely because it is reduced to writing by that non-Part 2 provider Applicability ( ) Provides that the recording of information about an SUD and its treatment by a non-Part 2 provider does not, by itself, render a medical record subject to Part 2, provided that the non-Part 2 provider segregates any specific SUD records that it receives 2020 American Psychiatric Association.